cakephp/tests/TestCase/Network/Http/Auth/OauthTest.php

<?php
/**
 * CakePHP(tm) : Rapid Development Framework (http://cakephp.org)
 * Copyright (c) Cake Software Foundation, Inc. (http://cakefoundation.org)
 *
 * Licensed under The MIT License
 * Redistributions of files must retain the above copyright notice.
 *
 * @copyright     Copyright (c) Cake Software Foundation, Inc. (http://cakefoundation.org)
 * @link          http://cakephp.org CakePHP(tm) Project
 * @since         3.0.0
 * @license       http://www.opensource.org/licenses/mit-license.php MIT License
 */
namespace Cake\Test\TestCase\Network\Http\Auth;

use Cake\Network\Http\Auth\Oauth;
use Cake\Network\Http\Request;
use Cake\TestSuite\TestCase;

/**
 * Oauth test.
 */
class OauthTest extends TestCase
{

    /**
     * @expectedException \Cake\Core\Exception\Exception
     */
    public function testExceptionUnknownSigningMethod()
    {
        $auth = new Oauth();
        $creds = [
            'consumerSecret' => 'it is secret',
            'consumerKey' => 'a key',
            'token' => 'a token value',
            'tokenSecret' => 'also secret',
            'method' => 'silly goose',
        ];
        $request = new Request();
        $auth->authentication($request, $creds);
    }

    /**
     * Test plain-text signing.
     *
     * @return void
     */
    public function testPlainTextSigning()
    {
        $auth = new Oauth();
        $creds = [
            'consumerSecret' => 'it is secret',
            'consumerKey' => 'a key',
            'token' => 'a token value',
            'tokenSecret' => 'also secret',
            'method' => 'plaintext',
        ];
        $request = new Request();
        $auth->authentication($request, $creds);

        $result = $request->header('Authorization');
        $this->assertContains('OAuth', $result);
        $this->assertContains('oauth_version="1.0"', $result);
        $this->assertContains('oauth_token="a%20token%20value"', $result);
        $this->assertContains('oauth_consumer_key="a%20key"', $result);
        $this->assertContains('oauth_signature_method="PLAINTEXT"', $result);
        $this->assertContains('oauth_signature="it%20is%20secret%26also%20secret"', $result);
        $this->assertContains('oauth_timestamp=', $result);
        $this->assertContains('oauth_nonce=', $result);
    }

    /**
     * Test that baseString() normalizes the URL.
     *
     * @return void
     */
    public function testBaseStringNormalizeUrl()
    {
        $request = new Request();
        $request->url('HTTP://exAmple.com:80/parts/foo');

        $auth = new Oauth();
        $creds = [];
        $result = $auth->baseString($request, $creds);
        $this->assertContains('GET&', $result, 'method was missing.');
        $this->assertContains('http%3A%2F%2Fexample.com%2Fparts%2Ffoo', $result);
    }

    /**
     * Test that the query string is stripped from the normalized host.
     *
     * @return void
     */
    public function testBaseStringWithQueryString()
    {
        $request = new Request();
        $request->url('http://example.com/search?q=pogo&cat=2');

        $auth = new Oauth();
        $values = [
            'oauth_version' => '1.0',
            'oauth_nonce' => uniqid(),
            'oauth_timestamp' => time(),
            'oauth_signature_method' => 'HMAC-SHA1',
            'oauth_token' => 'token',
            'oauth_consumer_key' => 'consumer-key',
        ];
        $result = $auth->baseString($request, $values);
        $this->assertContains('GET&', $result, 'method was missing.');
        $this->assertContains(
            'http%3A%2F%2Fexample.com%2Fsearch&',
            $result
        );
        $this->assertContains(
            'cat%3D2%26oauth_consumer_key%3Dconsumer-key' .
            '%26oauth_nonce%3D' . $values['oauth_nonce'] .
            '%26oauth_signature_method%3DHMAC-SHA1' .
            '%26oauth_timestamp%3D' . $values['oauth_timestamp'] .
            '%26oauth_token%3Dtoken' .
            '%26oauth_version%3D1.0' .
            '%26q%3Dpogo',
            $result
        );
    }

    /**
     * Ensure that post data is sorted and encoded.
     *
     * Keys with array values have to be serialized using
     * a more standard HTTP approach. PHP flavoured HTTP
     * is not part of the Oauth spec.
     *
     * See Normalize Request Parameters (section 9.1.1)
     * http://wiki.oauth.net/w/page/12238556/TestCases
     *
     * @return void
     */
    public function testBaseStringWithPostData()
    {
        $request = new Request();
        $request->url('http://example.com/search?q=pogo')
            ->method(Request::METHOD_POST)
            ->body([
                'address' => 'post',
                'tags' => ['oauth', 'cake'],
                'zed' => 'last'
            ]);

        $auth = new Oauth();
        $values = [
            'oauth_version' => '1.0',
            'oauth_nonce' => uniqid(),
            'oauth_timestamp' => time(),
            'oauth_signature_method' => 'HMAC-SHA1',
            'oauth_token' => 'token',
            'oauth_consumer_key' => 'consumer-key',
        ];
        $result = $auth->baseString($request, $values);

        $this->assertContains('POST&', $result, 'method was missing.');
        $this->assertContains(
            'http%3A%2F%2Fexample.com%2Fsearch&',
            $result
        );
        $this->assertContains(
            '&address%3Dpost' .
            '%26oauth_consumer_key%3Dconsumer-key' .
            '%26oauth_nonce%3D' . $values['oauth_nonce'] .
            '%26oauth_signature_method%3DHMAC-SHA1' .
            '%26oauth_timestamp%3D' . $values['oauth_timestamp'] .
            '%26oauth_token%3Dtoken' .
            '%26oauth_version%3D1.0' .
            '%26q%3Dpogo' .
            '%26tags%3Dcake' .
            '%26tags%3Doauth' .
            '%26zed%3Dlast',
            $result
        );
    }

    /**
     * Test HMAC-SHA1 signing
     *
     * Hash result + parameters taken from
     * http://wiki.oauth.net/w/page/12238556/TestCases
     *
     * @return void
     */
    public function testHmacSigning()
    {
        $request = new Request();
        $request->url('http://photos.example.net/photos')
            ->body([
                'file' => 'vacation.jpg',
                'size' => 'original'
            ]);

        $options = [
            'consumerKey' => 'dpf43f3p2l4k3l03',
            'consumerSecret' => 'kd94hf93k423kf44',
            'tokenSecret' => 'pfkkdhi9sl3r4s00',
            'token' => 'nnch734d00sl2jdk',
            'nonce' => 'kllo9940pd9333jh',
            'timestamp' => '1191242096'
        ];
        $auth = new Oauth();
        $auth->authentication($request, $options);

        $result = $request->header('Authorization');
        $expected = 'tR3+Ty81lMeYAr/Fid0kMTYa/WM=';
        $this->assertContains(
            'oauth_signature="' . $expected . '"',
            urldecode($result)
        );
    }

    /**
     * Test RSA-SHA1 signing
     *
     * Hash result + parameters taken from
     * http://wiki.oauth.net/w/page/12238556/TestCases
     *
     * @return void
     */
    public function testRsaSigning() {
        $request = new Request();
        $request->url('http://photos.example.net/photos')
            ->body([
                       'file' => 'vacaction.jpg',
                       'size' => 'original'
                   ]);
        $private_key_path = TEST_APP . DS . 'config' . DS . 'key.pem';

        $options = [
            'method' => 'RSA-SHA1',
            'consumerKey' => 'dpf43f3p2l4k3l03',
            'nonce' => '13917289812797014437',
            'timestamp' => '1196666512',
            'private_key_file' => $private_key_path,
        ];
        $auth = new Oauth();
        $auth->authentication($request, $options);

        $result = $request->header('Authorization');
        $expected = 'jvTp/wX1TYtByB1m+Pbyo0lnCOLIsyGCH7wke8AUs3BpnwZJtAuEJkvQL2/9n4s5wUmUl4aCI4BwpraNx4RtEXMe5qg5T1LVTGliMRpKasKsW//e+RinhejgCuzoH26dyF8iY2ZZ/5D1ilgeijhV/vBka5twt399mXwaYdCwFYE=';
        $this->assertContains(
            'oauth_signature="' . $expected . '"',
            urldecode($result)
        );
    }

    /**
     * Test RSA-SHA1 signing with passphrase string
     *
     * Hash result + parameters taken from
     * http://wiki.oauth.net/w/page/12238556/TestCases
     *
     * @return void
     */
    public function testRsaSigningWithPassphraseString() {
        $request = new Request();
        $request->url('http://photos.example.net/photos')
            ->body([
                       'file' => 'vacaction.jpg',
                       'size' => 'original'
                   ]);
        $private_key_path = TEST_APP . DS . 'config' . DS . 'key_with_passphrase.pem';
        $passphrase = 'fancy-cakephp-passphrase';

        $options = [
            'method' => 'RSA-SHA1',
            'consumerKey' => 'dpf43f3p2l4k3l03',
            'nonce' => '13917289812797014437',
            'timestamp' => '1196666512',
            'private_key_file' => $private_key_path,
            'private_key_passphrase' => $passphrase,
        ];
        $auth = new Oauth();
        $auth->authentication($request, $options);

        $result = $request->header('Authorization');
        $expected = 'jvTp/wX1TYtByB1m+Pbyo0lnCOLIsyGCH7wke8AUs3BpnwZJtAuEJkvQL2/9n4s5wUmUl4aCI4BwpraNx4RtEXMe5qg5T1LVTGliMRpKasKsW//e+RinhejgCuzoH26dyF8iY2ZZ/5D1ilgeijhV/vBka5twt399mXwaYdCwFYE=';
        $this->assertContains(
            'oauth_signature="' . $expected . '"',
            urldecode($result)
        );
    }

    /**
     * Test RSA-SHA1 signing with passphrase file
     *
     * Hash result + parameters taken from
     * http://wiki.oauth.net/w/page/12238556/TestCases
     *
     * @return void
     */
    public function testRsaSigningWithPassphraseFile() {
        $request = new Request();
        $request->url('http://photos.example.net/photos')
            ->body([
                       'file' => 'vacaction.jpg',
                       'size' => 'original'
                   ]);
        $private_key_path = TEST_APP . DS . 'config' . DS . 'key_with_passphrase.pem';

        if(PHP_EOL == "\n") $passphrase_path = TEST_APP . DS . 'config' . DS . 'key_passphrase_lf';
        else if(PHP_EOL == "\r\n") $passphrase_path = TEST_APP . DS . 'config' . DS . 'key_passphrase_crlf';
        else if(PHP_EOL == "\r") $passphrase_path = TEST_APP . DS . 'config' . DS . 'key_passphrase_cr';
        else { $this->markTestSkipped('The file for the key passphrase could not be loaded as PHP_EOL could not be recognized.'); return; }
        $passphrase = fopen($passphrase_path, 'r');

        $options = [
            'method' => 'RSA-SHA1',
            'consumerKey' => 'dpf43f3p2l4k3l03',
            'nonce' => '13917289812797014437',
            'timestamp' => '1196666512',
            'private_key_file' => $private_key_path,
            'private_key_passphrase' => $passphrase,
        ];
        $auth = new Oauth();
        $auth->authentication($request, $options);

        $result = $request->header('Authorization');
        $expected = 'jvTp/wX1TYtByB1m+Pbyo0lnCOLIsyGCH7wke8AUs3BpnwZJtAuEJkvQL2/9n4s5wUmUl4aCI4BwpraNx4RtEXMe5qg5T1LVTGliMRpKasKsW//e+RinhejgCuzoH26dyF8iY2ZZ/5D1ilgeijhV/vBka5twt399mXwaYdCwFYE=';
        $this->assertContains(
            'oauth_signature="' . $expected . '"',
            urldecode($result)
        );
        $expected = 0;
        $this->assertEquals($expected, ftell($passphrase));
    }
}